I'm working with an Issuing CA that doesn't support name constraints that are defined at a higher level.

Assuming that it issues certificates that are compliant with the Name Constraints that are defined, would this be an issue with clients that validate the chain?


I wouldn't guarantee that everyone does it right, but the entire certificate chain up to a trusted root should be validated to be valid for the certificate name. As long as the only certs generated are valid, it should be ok, but if an intermediate CA signs something it isn't authorized to sign, then the validation should fail as the intermediate CA isn't trusted to perform that signature.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.